How can I manipulate the "from" field in an email and make the "to" user see something different then the actual.


really from

From: TStamper@yahoo.com

but they see

From: Tremayne "Top Dog" Stamper

I've heard its from manipulating SMTP, but really not sure how accurate that is or how it can be done

  • 2
    I see this in as a valid issue. We do this all the time (particularly make an e-mail from a piece of software look like it's sending for a user).
    – C. Ross
    May 7, 2009 at 15:08
  • I agree that it can be a valid issue if you want to change the From field to display something like a real name instead of an address. We do that all the time in our systems also. It's just a little bit of a flag because of the example in the question, changing from one address to another. Spam bait.
    – squillman
    May 7, 2009 at 15:11
  • updated with better example
    – TStamper
    May 7, 2009 at 15:13
  • Thats why they created SPF records Jun 1, 2009 at 2:21

6 Answers 6


At its base, SMTP is just a text based protocol with no real verification. Here's an example:

=== Trying g3.example.net:25...
=== Connected to g3.example.net.
<-  220 home.example.net ESMTP Exim 4.68 Thu, 07 May 2009 11:03:21 -0400
 -> EHLO g3.example.net
<-  250-home.example.net Hello g3.example.net []
<-  250-SIZE 52428800
<-  250-STARTTLS
<-  250 HELP
 -> MAIL FROM:<jj33@g3.example.net>
<-  250 OK
 -> RCPT TO:<jj33@g3.example.net>
<-  250 Accepted
 -> DATA
<-  354 Enter message, ending with "." on a line by itself
 -> Date: Thu, 07 May 2009 11:03:21 -0400
 -> To: jj33@g3.example.net
 -> From: jj33@g3.example.net
 -> Subject: test Thu, 07 May 2009 11:03:21 -0400
 -> X-Mailer: swaks v20070921.0-dev jetmore.org/john/code/#swaks
 -> This is a test mailing
 -> .
<-  250 OK id=KJA4HL-0006M6-8T
 -> QUIT
<-  221 home.example.net closing connection
=== Connection closed with remote host.

The "MAIL FROM:" line defines the SMTP envelope sender, and the From: is defined in the message DATA. There are ways to protect against this, but they are defined in the mail server logic, not in the protocol itself.

For instance I, as a mail provider, may require a user to authenticate using a user@domain type username. Then my mail server might require that any mail they send have an envelope-sender and a From: header that matches the user they authenticated as. Additional technologies like DKIM and SPF can help in this area also.


There are a couple of different things to consider here. If you just want to display a different name or e-mail address, set the "From" header of the message (the message from address) to the e-mail address with the display name in brackets as such:

From: Joe Example <joe@example.com>

Remember that the "from" line in the message header is only used for display purposes. The actual routing is done by the SMTP envelope address. This is what the SMTP servers actually use to transmit the message between servers. This can be different from the message "from" header. If you have a custom SMTP engine, just have it use one address in the SMTP envelope and a different one in the "from" header on the actual message.

There are a number of legitimate reasons that you might want to do this, but please refrain from nefarious purposes.

Note that a correct syntax example can be found in RFC 5322 - A.2.1

  • 1
    The bracket example is wrong, it's backwards
    – jj33
    May 7, 2009 at 15:29
  • Fixed; it's been a while since I've implemented this kind of thing. May 7, 2009 at 15:52
  • I updated it again now to match RFC 822
    – Mike Graf
    Jul 10, 2018 at 18:34
  • 1
    @MikeGraf 822 was superseded at least twice, 5322 is better. Jul 10, 2018 at 22:42
telnet some_smtp_server.com 25
ehlo whatsup
mail from: JohnBaker@yahoo.com
rcpt to: recipient@somewhere.com
your message here
end with a dot on a single line like this:

Of course you'll need an SMTP server that allows relaying, which is almost impossible to find... or roll your own (just don't use this knowledge to spam!).


The "really from" address comes from the "from:" dialog in the SMTP conversation.

The "fake from" comes from exploiting the common practice in email clients of displaying the various header fields as laid out in the Data portion of the SMTP conversation. For instance:

# telnet mail.example.com 25
Connected to mail.example.com.
Escape character is '^]'.
220 mail.example.com ESMTP Postfix
helo fakeserver
250 mail.example.com
mail from: real@example.com
250 2.1.0 OK
rcpt to: real@example.com
250 2.1.5 Ok
354 End data with <CR><LF>.<CR><LF>
from: fake@example.com
to: you@example.com
subject: This is a subject
This is the body.
250 2.0.0 Ok: queued as 90D0F95A06
221 2.0.0 Bye
Connection closed by foreign host.

If you had left out the "from:" and "to:" lines in the Data portion, it would have displayed the actual envelope sender and recipient.

Note that these sorts of tricks are often looked for by spam filters, and will certainly not make you any permanent friends. Also, this doesn't work on all mail clients (just the most common ones).


Yes, it's by manually setting SMTP headers and is trivial to accomplish. Google it. But don't get caught spamming......


This my 2c straight out of the code - written in C#

    public static void SendSpam(string message, string to)
        System.Net.Mail.MailMessage myMessage = new System.Net.Mail.MailMessage("Fake Name", to);
        myMessage.Subject = "SPAM";
        myMessage.Body = message;
        System.Net.Mail.SmtpClient client = new System.Net.Mail.SmtpClient("mail.mailserver.com", 25);
        System.Net.NetworkCredential c = new System.Net.NetworkCredential("realusername@mailserver.com", "realpassword");
        client.Credentials = c;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.